Chrome 156 update fixes critical MediaStream flaw and 19 high bugs

Chrome 156 update fixes critical MediaStream flaw and 19 high bugs

29 October 2026: Google has released Chrome 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux on the Stable and Extended Stable channels, with 21 security fixes. The most serious, CVE-2026-76024, is a critical memory corruption bug in MediaStream, the component that handles camera and microphone streams; 19 more are rated high. Google does not say that any of them is being exploited.

The fixes, by component

Google lists the fixes with restricted bug details, as it does until most users have updated:

CVE	Rating	Flaw	Component
CVE-2026-76024	Critical	Memory corruption	MediaStream
CVE-2026-76025, CVE-2026-76028	High	Use after free	FileSystem
CVE-2026-76030	High	Memory corruption	FileSystem
CVE-2026-76026	High	Memory corruption	Autofill
CVE-2026-76027	High	Memory corruption	CacheStorage
CVE-2026-76029	High	Memory corruption	Network
CVE-2026-76031	High	Use after free	Input
CVE-2026-119260	High	Use after free	Frames
CVE-2026-119261, CVE-2026-119271	High	Input validation, use after free	Skia
CVE-2026-119262	High	Improper input validation	V8
CVE-2026-119263	High	Memory corruption	Garbage collection
CVE-2026-119264	High	Memory corruption	Dawn (WebGPU)
CVE-2026-119265, CVE-2026-119266	High	Memory corruption, use after free	Quota
CVE-2026-119267	High	Memory corruption	DOM
CVE-2026-119268	High	Integer overflow	Editing
CVE-2026-119269	High	Use after free	Blink
CVE-2026-119270	High	Improper input validation	CacheStorage
CVE-2026-119272	Medium	Out-of-bounds read	FileSystem

One researcher, four reports

Xinyang Ge reported the critical MediaStream bug on 21 October, eight days before the fix shipped, and three of the high-rated bugs as well (garbage collection, DOM and Editing). Hyeonjun Ahn reported the V8 input validation flaw on 17 October. Most of the others were found by Google's own teams and fuzzers, and the oldest, a FileSystem use after free, was reported on 10 September.

FileSystem accounts for four of the 21, and storage-related code (FileSystem, CacheStorage and Quota) for seven, which points to a concentrated review or fuzzing effort on that part of the browser this cycle.

Rolling the update out

Google says the desktop build rolls out "over the coming days/weeks", so a fleet left to update itself can sit on the older build for some time. Administrators who manage Chrome through group policy or a device management service can push 156.0.8078.79 now rather than waiting. The Extended Stable channel, used by organisations that move to a new major version every eight weeks, received the same fixes. Chrome for Android 156.0.8078.79, released the same day, carries the same security fixes and reaches Google Play over the next few days.

The Hong Kong Computer Emergency Response Team listed the update on 30 October and rates the set medium risk, naming denial of service, remote code execution, security restriction bypass and information disclosure as the possible impacts. Browsers built on Chromium, such as Microsoft Edge, Brave and Opera, take these fixes in their own releases.

We list Google as a company.

Related on TrustList:

• Google and OpenAI both retire their custom assistant builders
• ChromeOS 16805.33.0 fixes 106 Chrome bugs, five of them Critical
• Google stops paying bounties for flaws in Go, Angular and other OSS

Sources

• Chrome Releases: Stable Channel Update for Desktop, 29 October 2026
• Chrome Releases: Chrome for Android Update, 29 October 2026
• HKCERT: Google Chrome multiple vulnerabilities, 30 October 2026